How to prevent malicious code execution loading blend files?
Yes, It is enough to open a blend file with Trusted Source disabled. *

But looking the the text editor is not the only place that can contain code. Animation driver expressions can also contain code too.

Take care, even when the file is not trusted you could inadvertently run a script by...


Starting the game engine.
Rendering with freestyle.
Executing a command in the Python console.


If you are in a situation where you need to load blend files you don't trust (an online render-farm for example). Suggest to sandbox the environment Blender runs in (see containers).



* There is the possibility of crafting a file which makes use of a buffer overrun exploit, these are much more involved then writing malicious Python scripts.



For reference, this is a known pain-point, see these threads:


"Python Security gets in the way"http://lists.blender.org/pipermail/bf-committers/2010-April/027216.html
"Python Sandbox"http://lists.blender.org/pipermail/bf-committers/2010-March/026778.html
"Please turn off Auto Run Python Scripts by default"http://lists.blender.org/pipermail/bf-committers/2013-June/040502.html
"Trusted blend files and scripted drivers bug and annoyance"http://lists.blender.org/pipermail/bf-committers/2013-August/041464.html
"Keymaps and presets - Security issues?"http://lists.blender.org/pipermail/bf-committers/2015-June/045523.html